security fix: validate certificates and not only host names (thanks Günter)